PT-2020-10915 · Suse · Yast2-Security

Johannes Segitz · Published 2020-01-24 · Updated 2024-06-15 · CVE-2019-3700

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions yast2-security versions prior to 4.2.6

Description The issue arose due to insecure default settings in yast2-security, which led to the use of DES password encryption for passwords created during a specific time frame. This made the passwords vulnerable to attackers who could access the password hashes. The problem began when configuration files setting secure settings were moved to a different location on 2019-10-07, and it persisted until yast2-security switched to stronger defaults.

Recommendations For versions prior to 4.2.6, update to version 4.2.6 or later to switch to stronger default settings and mitigate the risk of insecure password encryption.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2019-3700

OPENSUSE-SU-2024:11536-1

Affected Products

Yast2-Security

References · 5

• https://osv.dev/vulnerability/openSUSE-SU-2024:11536-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3700 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3700 · Security Note
• https://bugzilla.suse.com/show_bug.cgi?id=1157541 · Vendor Advisory
• https://suse.com/security/cve/CVE-2019-3700 · Note